This file describes what careerpdf.com does with your data and how to report a security problem.
Every tool on CareerPDF reads and writes files inside your browser:
- PDFs are opened and edited with pdf-lib and PDF.js, in the page or in a Web Worker.
- Images are resized and compressed on a canvas in the browser.
- Resumes, cover letters and official letters are generated as PDFs in the browser.
No file, page, image or typed text is uploaded to CareerPDF or to anyone else. You can confirm this in your browser's developer tools (Network tab) while you use any tool.
- No third-party scripts, fonts, analytics, trackers or ads networks. The privacy meter on every page counts requests to other domains, and it shows 0.
- No cookies.
- The Content Security Policy enforces this:
script-src 'self'(with'unsafe-inline', required by Next.js static export) andconnect-src 'self'. A script injected from another domain would be blocked by the browser. - HTTPS only, with HSTS (
max-age=63072000; includeSubDomains; preload).
Two anonymous counters on careerpdf.com itself, stored as daily totals in a Cloudflare D1 database:
| Endpoint | When | What is stored |
|---|---|---|
POST /api/stats |
You save a file from a tool | Day, event download, and the tool name (e.g. merge-pdf), plus 1 |
POST /api/installs |
You install the web app | Day, platform type, plus 1 |
No IP address, cookie, user agent, file name, file content or identifier is stored. Requests are sent with credentials: 'omit'.
Resume and letter drafts are saved in your browser's localStorage after your first edit, so you don't lose your work. They are never sent anywhere. Clear them by clearing the site's data in your browser.
Please email hello@careerpdf.com with a description and steps to reproduce. The same contact is published in /.well-known/security.txt (RFC 9116).
- Please don't publish the issue until it is fixed.
- We aim to reply within 7 days.
- In scope: careerpdf.com and its subpaths. Out of scope: denial-of-service, automated scanner output without a working proof of concept, and missing headers that don't lead to an exploit.
Only the live site at https://careerpdf.com/ is supported. Every deploy replaces the previous version.
ملفاتك لا تغادر جهازك. كل أدوات CareerPDF تفتح الملفات وتعدّلها وتنشئها داخل متصفحك. لا يُرفع أي ملف أو نص إلى CareerPDF ولا إلى أي جهة أخرى.
- لا سكربتات ولا خطوط ولا تحليلات ولا إعلانات من أي طرف ثالث، ولا كوكيز. عدّاد الخصوصية في كل صفحة يعرض 0 طلبات إلى نطاقات أخرى.
- الشيء الوحيد الذي يُرسل هو عدّادان مجهولا الهوية إلى الموقع نفسه: عند حفظ ملف (اليوم واسم الأداة فقط)، وعند تثبيت التطبيق (اليوم ونوع الجهاز فقط). بلا عنوان IP ولا أي معرّف.
- مسودات السيرة والخطابات تُحفظ في متصفحك فقط (localStorage) بعد أول تعديل.
للإبلاغ عن ثغرة أمنية: hello@careerpdf.com.